Depends how detailed you want to go but I'd set up a network bridge to an external network source (The affected PC you connected to gain network access should be the ), use an NIDS/packet logging utility and also log all IPs on the select inbound LAN IP address through the router so that everything is sure. If stuff is suspicious, I'd just google it and if it's nasty as in can't remove, zip important files, backup steam games (also zip) and place on an autorun-disabled memory-stick or drive (make sure you disconnect from the internet when you do that though because obvious). Also edit permissions on the files if necessary to restrict nasty and finally allow operating system files to viewed (different from hidden files).
Might be an option to close as many programs as possible to remove network packet logging noise such as Skype and Steam.
A great website to go to for help is techspot.com they have a whole section for dealing with malware.
Do whois searches to check for VPS companies and other organisations that people use to relay data 24/7 or such, common sense means it won't be the IP of a site like google or a DNS IP such as 8.8.8.8.
a plusserver.de user port scanned me a month ago and from that point I started performing strict input sanitization on all my custom external-internet scripts. And just recently some idiot is trying to access web ports, 80, 443 etc on my router.
Sorry if this is a jumbled mess of sentences but anyway that's what I would do if I smelt a RAT.
http://www.youtube.com/watch?v=m3qHepWxn-k
